文章目录
- 1.日志收集规划
- 2.Elasticsearch部署
- 2.1.Elasticsearch安装
- 2.2.Elasticsearch-head安装
- 2.3.Elasticsearch设置分片数
- 2.4.elasticsearch健康检查
- 3.Kibana部署
- 4.Logstash部署
- 5.Filebeat部署
- 开源中间件
# Elastic Stackhttps://iothub.org.cn/docs/middleware/
https://iothub.org.cn/docs/middleware/elk/elk-deploy/
1.日志收集规划
日志管理使用Elastic Stack框架，系统的重要日志进行聚合，统一管理。
涉及的组件包括：Elasticsearch、Filebeat、Logstash、Kibana、RabbitMQ、Nginx。
- 微服务日志采集
微服务日志通过Logback写到MQ（kafka或rabbitmq，目前选择rabbitmq），logstash读取MQ把日志写到Elasticsearch，通过Kibana查询。
- 中间件、数据库日志采集
中间件、数据库日志通过Filebeat写到Elasticsearch，通过Kibana查询。
生产环境日志架构
2.Elasticsearch部署
2.1.Elasticsearch安装
- 准备工作
### 准备工作
# 启动简单版，然后 copy 文件到 宿主机，最后删除该容器# 创建目录
mkdir -p /elk/cluster/es# 运行docker
docker run -tid \
--name=elasticsearch \
-p 19200:9200 \
-p 19300:9300 \
-v /etc/localtime:/etc/localtime \
-e ES_JAVA_OPTS="-Xms4g -Xmx4g" \
-e TZ='Asia/Shanghai' \
-e LANG="en_US.UTF-8" \
elasticsearch:7.1.1# 复制配置文件
docker cp elasticsearch:/usr/share/elasticsearch/config/ /elk/cluster/es/
docker cp elasticsearch:/usr/share/elasticsearch/data/ /elk/cluster/es/
docker cp elasticsearch:/usr/share/elasticsearch/logs/ /elk/cluster/es/
docker cp elasticsearch:/usr/share/elasticsearch/plugins/ /elk/cluster/es/# 删除镜像
docker stop elasticsearch
docker rm elasticsearch
- 配置es
### es-node-01配置（172.17.88.22）
# 修改配置文件
/elk/cluster/es/config/elasticsearch.yml# elasticsearch.yml：
cluster.name: es-iids-cluster
node.name: es-node-01
node.master: true
node.data: true
network.host: 172.17.88.22
http.port: 9200
transport.tcp.port: 9300
discovery.seed_hosts: ["172.17.88.22", "172.17.88.19", "172.17.88.18"]
cluster.initial_master_nodes: ["es-node-01", "es-node-02", "es-node-03"]
bootstrap.memory_lock: false
http.cors.enabled: true
http.cors.allow-origin: "*"# jvm.options
-Xms1g
-Xmx1g
其他三个节点配置相同。
- 运行Docker
# 运行dockerdocker run -d --name es-node-01 --net host --restart=always \
-v /elk/cluster/es/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
-v /elk/cluster/es/config/jvm.options:/usr/share/elasticsearch/config/jvm.options \
-v /elk/cluster/es/data/:/usr/share/elasticsearch/data/ \
-v /elk/cluster/es/logs/:/usr/share/elasticsearch/logs/ \
-v /elk/cluster/es/plugins/:/usr/share/elasticsearch/plugins/ \
elasticsearch:7.1.1
### 访问地址# es-node-01（172.17.88.22）
http://47.95.238.119:19200/
curl '172.17.88.22:9200'
2.2.Elasticsearch-head安装
- 运行Docker
# 运行Docker,三个节点分别安装docker run -d --name es-head --restart=always -p 19100:9100 mobz/elasticsearch-head:5
### 安装遇到问题# 连不上elasticsearch
docker exec -it elasticsearch /bin/bash
vi ES配置文件elasticsearch.yml加入2个参数，并重启http.cors.enabled: true
http.cors.allow-origin: "*"# 重启容器
docker restart elasticsearch
# 访问地址http://47.95.238.119:19100/
curl '172.17.88.22:19100'
2.3.Elasticsearch设置分片数
elasticsearch7.x 设置默认副本 和默认分片
# 设置elasticsearch默认模板（之后创建索引副本为）
curl -X PUT 47.95.238.119:19200/_template/log -H 'Content-Type: application/json' -d '{"template": "*","settings": {"number_of_shards": 5,"number_of_replicas": "1"}
}'"template": "*" 代表所有 索引
"template": "apple*" 代表生成apple*的索引都会按照这个模板来了
# 设置默认分片5，副本1curl -X PUT 47.95.238.119:19200/_template/log -H 'Content-Type: application/json' -d '{"template": "*","settings": {"number_of_shards": 5,"number_of_replicas": 1}
}'
2.4.elasticsearch健康检查
# 常用查询命令# 查看集群进程状态:
curl -u elastic:{password} -X GET "172.18.54.20:9200/_nodes/stats/process?pretty"
http://47.95.238.119:19200/_nodes/stats/process?pretty#检查集群状态:
curl -u elastic:{password} -X GET "172.18.54.20:9200/_nodes/stats?pretty"
http://47.95.238.119:19200/_nodes/stats?pretty# 查看ES集群健康状态
curl -u elastic:{password} -X GET "172.18.54.20:9200/_cluster/health?pretty"
http://47.95.238.119:19200/_cluster/health?prettycurl -u elastic:{password} -X GET "172.18.54.20:9200/_cluster/health?level=indices"
http://47.95.238.119:19200/_cluster/health?level=indices# 查看指定索引库的健康状态
curl -u elastic:{password} -X GET "172.18.54.20:9200/_cluster/health/{indexName}?pretty"
http://47.95.238.119:19200/_cluster/health/{indexName}?pretty
3.Kibana部署
- 准备工作
### 准备工作
# 启动简单版，然后 copy 文件到 宿主机，最后删除该容器# 创建目录
mkdir -p /elk/cluster/kibana# 运行docker
docker run -tid \
--name=kibana \
-p 15601:5601 \
-v /etc/localtime:/etc/localtime \
-e TZ='Asia/Shanghai' \
-e LANG="en_US.UTF-8" \
kibana:7.1.1# 复制配置文件
docker cp kibana:/usr/share/kibana/config/ /elk/cluster/kibana/
docker cp kibana:/usr/share/kibana/data/ /elk/cluster/kibana/
docker cp kibana:/usr/share/kibana/plugins/ /elk/cluster/kibana/# 删除镜像
docker stop kibana
docker rm kibanachmod 777 /elk/cluster/kibana/data
- 修改配置文件
# 修改配置文件
/elk/cluster/kibana/config/kibana.yml# kibana.yml
server.port: 15601
server.name: kibana
server.host: "0.0.0.0"
elasticsearch.hosts: [ "http://172.17.88.22:9200", "http://172.17.88.19:9200", "http://172.17.88.18:9200" ]
xpack.monitoring.ui.container.elasticsearch.enabled: true# 没有配置以下内容
elasticsearch.username: kibana
elasticsearch.password: keda123456
xpack.security.encryptionKey: "something_at_least_32_characters"
xpack.reporting.encryptionKey: "something_at_least_32_characters"
xpack.security.sessionTimeout: 600000
- 运行Docker
# 运行docker docker run -d --name kibana --net host --restart=always \
-v /elk/cluster/kibana/config/:/usr/share/kibana/config/ \
-v /elk/cluster/kibana/data/:/usr/share/kibana/data/ \
-v /elk/cluster/kibana/plugins/:/usr/share/kibana/plugins/ \
kibana:7.1.1
### 访问地址
http://47.95.238.119:15601
http://47.95.228.247:15601
http://123.56.18.37:15601
4.Logstash部署
- 准备工作
### 准备工作
# 启动简单版，然后 copy 文件到 宿主机，最后删除该容器# 创建目录
mkdir -p /elk/cluster/logstash# 运行docker
docker run -tid \
--name=logstash \
-p 15044:5044 \
-p 19600:9600 \
-v /etc/localtime:/etc/localtime \
-e TZ='Asia/Shanghai' \
-e LANG="en_US.UTF-8" \
logstash:7.1.1# 复制配置文件
docker cp logstash:/usr/share/logstash/config/ /elk/cluster/logstash/
docker cp logstash:/usr/share/logstash/pipeline/ /elk/cluster/logstash/# 先不用
docker cp logstash:/usr/share/logstash/data/ /elk/cluster/logstash/
docker cp logstash:/usr/share/logstash/vendor/ /elk/cluster/logstash/# 删除镜像
docker stop logstash
docker rm logstash
- 修改配置文件
# 修改配置文件
/elk/cluster/logstash/config/logstash.yml (可不配置)
http.host: "0.0.0.0"
xpack.monitoring.enabled: false# /elk/cluster/logstash/pipeline/logstash.conf
# logstash.conf：# 采集rabbitmq
input {rabbitmq {type =>"msa"durable => trueexchange => "iids-elk-msa-exchange"exchange_type => "direct"key => "log"host => "172.17.88.22"port => 5672user => "guest"password => "guest"queue => "iids-elk-msa-queue"auto_delete => false}}output {elasticsearch {hosts => ["172.17.88.22:9200", "172.17.88.19:9200", "172.17.88.18:9200"]index => "%{appname}-%{+YYYY.MM.dd}"}stdout {codec => rubydebug}}# 采集filebeat
input {beats {port => 5044}
}output {elasticsearch {hosts => ["172.17.88.22:19200", "172.17.88.19:19200", "172.17.88.18:19200"]index => "%{appname}-%{+YYYY.MM.dd}"}stdout {codec => rubydebug}}
- 运行Docker
# 运行docker docker run -d --name logstash --net host --restart=always \
-v /elk/cluster/logstash/config:/usr/share/logstash/config \
-v /elk/cluster/logstash/pipeline:/usr/share/logstash/pipeline \
logstash:7.1.1
5.Filebeat部署
### rpm安装
rpm -vih filebeat-7.1.1-x86_64.rpm# 启动filebeat服务
systemctl start filebeat# 停止filebeat服务
systemctl stop filebeat# 设置开机自启动
systemctl enable filebeat # 常用命令
systemctl start filebeat #启动服务
systemctl stop filebeat #停止服务
systemctl enable filebeat #设置开机自启动
systemctl disable filebeat #停止开机自启动
systemctl status filebeat #查看服务当前状态
systemctl restart filebeat #重新启动服务
systemctl list-units --type=service #查看所有已启动的服务
- 开源中间件
# Elastic Stackhttps://iothub.org.cn/docs/middleware/
https://iothub.org.cn/docs/middleware/elk/elk-deploy/
![LeetCode[题解] 1261. 在受污染的二叉树中查找元素](https://img-blog.csdnimg.cn/img_convert/9f0b899745d6a3a7cddc13a738e5e4d9.jpeg)
![[Java、Android面试]_02_HashMap的原理](https://img-blog.csdnimg.cn/direct/5b1318cc44aa4d1d87fab17497120e2a.png#pic_center)